Next.js patches critical unauthenticated RCE in image optimization
The flaw affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Patched releases are 15.5.28 and 16.4.1.
GitHub published security advisory GHSA-2464-fhr4-w9xw on 22 October 2026 and rated the issue critical. The vulnerability is in an upstream library that Next.js uses for Image Optimization, and it can be triggered when SVG files are processed. The memory-related flaw can lead to possible remote code execution without authentication on glibc-based Linux systems. The issue affects deployments that use the Image Optimization API with SVG files. [1]
Affected npm package versions are next 10.0.0 through 15.5.27 and next 16.0.0 through 16.4.0. The fixed releases are 15.5.28 and 16.4.1. [1]
As a workaround, keep sharp at version 0.35.5 or newer. Fresh installs receive a fixed sharp automatically, and upgrading Next.js to a patched release makes package managers pull a fixed sharp. Administrators should upgrade to the fixed release for their installed major line, 15.5.28 or 16.4.1, or confirm that sharp is at least 0.35.5. [1]
Sources
- Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used, GitHub Advisory Database
Lena Vasquez covers vulnerabilities, breaches and identity for Five Nines. She writes from advisories, vendor bulletins and published reporting.
Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.